CVE-2022-25020

MediumCVSS 5.4

Published: 01/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.17%

64th percentile - higher than 64% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.

Risk Assessment

The risk includes session hijacking, redirection to malicious sites, or theft of sensitive data, potentially compromising system confidentiality and integrity.

Recommendation

Immediately update Pluxml to the latest version and implement input validation for thumbnail paths.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.